Citizen Lab Reveals Zero-Click Spyware Infection via Targeted Online Ads
Researchers document the first technical proof of mercenary spyware delivered through advertisements without requiring user interaction or clicks.
Key points
- Citizen Lab identified "AdFection," a method delivering zero-click spyware via targeted ads to Al Jazeera devices.
- The campaign utilized Discover-Tech infrastructure to link ad markets with commercial spyware groups like Candiru.
- At least 45 devices were targeted in 2024 and 2025, with millions of devices subjected to tracking checks.
Citizen Lab researchers published technical proof on October 15, 2026, demonstrating that viewing an online advertisement can infect a device with spyware. This method, named AdFection, requires no user clicks, file downloads, or visible warnings to execute the infection.
The investigation confirmed that this zero-click technique was used to compromise devices belonging to the international news network Al Jazeera. The spyware installed on these systems is linked to the Israeli vendor Candiru, which currently operates under the name Integrity Labs. This represents the first public documentation of mercenary spyware delivered through targeted advertising channels.
How the AdFection Method Works
Discover-Tech, an Israeli company posing as an advertising business, served as the intermediary between the ad market and spyware groups. Its Controlium platform enabled customers to target individuals using mobile advertising IDs, browser cookies, and IP addresses. This infrastructure allowed for precise targeting within the digital advertising ecosystem.
When an ad loaded on a user’s device, embedded code contacted a Discover-Tech server. That server determined if the visitor matched specific target criteria. If the details aligned, the server returned JavaScript that loaded additional code, initiating the infection process without any interaction from the user.
This exploit leverages the complex nature of modern digital ads, which often include tracking code and load content from third parties. Real-time bidding systems share device data, such as location and browser details, within fractions of a second. AdFection used this rapid data exchange to identify targets and deliver malicious code selectively, making detection by ad platforms difficult.
Scope and Impact of the Campaign
According to the Citizen Lab report, at least 45 Al Jazeera devices were targeted during 2024 and 2025. Network logs showed infected systems first contacted Discover-Tech infrastructure after an ad was displayed. They subsequently connected to a Candiru validation server for device checks before linking to command-and-control servers.
The scale of the underlying operation was significantly larger than the confirmed infections. Researchers analyzed approximately four billion Discover-Tech bidding records from four months in 2026. The company’s ads appeared on nearly 200,000 unique websites and mobile apps across dozens of countries during this period.
Millions of devices were quietly directed toward Candiru-linked servers, likely for tracking and preliminary checks before potential targeting. However, Citizen Lab noted that merely seeing a Discover-Tech ad does not prove a device was infected. The data indicates widespread surveillance infrastructure rather than universal compromise.
What should you do?
Security teams should monitor network logs for connections to known spyware command-and-control servers and Discover-Tech infrastructure. Organizations should review ad-blocking policies and consider restricting third-party ad networks on sensitive devices. No fix has been confirmed yet for this specific exploitation method.
What to do and how to stay safe: Citizen Lab
- Monitor network traffic for connections to known spyware validation servers and Discover-Tech infrastructure.
- Implement strict ad-blocking policies on devices handling sensitive information to reduce exposure.
- Review browser permissions and limit data sharing with third-party advertising networks.
- Keep operating systems and browsers updated to mitigate potential code execution vulnerabilities.
Step-by-step guide: Endpoint Detection and Response Examples: How EDR Stops Hidden Threats
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does clicking on an ad cause the infection?
No, the AdFection method is a zero-click exploit that infects devices simply by viewing the ad.
Which spyware vendor was involved in this campaign?
The spyware is linked to Candiru, which now operates as Integrity Labs.
How many Al Jazeera devices were targeted?
At least 45 Al Jazeera devices were targeted during 2024 and 2025.
